Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 16:50
Static task
static1
Behavioral task
behavioral1
Sample
af6ade889a927447b5a402483f5f07c2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
af6ade889a927447b5a402483f5f07c2_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
af6ade889a927447b5a402483f5f07c2_JaffaCakes118.html
-
Size
5KB
-
MD5
af6ade889a927447b5a402483f5f07c2
-
SHA1
ea50597eee354eefc7e05af6cae7ce44d9f728cb
-
SHA256
1264f6854d2f7c07b4ec6f69d9e83ae5e47ff4b1e00e3a9425af3a335171ebe6
-
SHA512
71759c8d4eb6138172cfad17a3630337693a12945351d7a5bacb94cea06b72ae84842d9a854be0d56ccaa4a60b40d1cb46fff5feb4e9a2ab1e410a2da99f77b0
-
SSDEEP
96:Tb+cNDuuJ9BVvmjXeJ5k6vJchJxJcmq+J2bkiJJgs0Jx5OnJstFJqtJOQKC:TxSupVyeJe6voL3kQz0n+QFKC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424632091" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a58ace66fb2ae94baa2183525e2f0ec500000000020000000000106600000001000020000000ad6987e6b7f47fb7c478b387e04d51d7a0b32e54b12fa15429838327646e713f000000000e8000000002000020000000f9e62c370d6cfa7b85a482b4693b93248819b969aa6bcf9eedfe51473a4166d49000000057e69d5cb272f2c9b0936cb69912bde8634d9d54ecbcd7a51c69e5a7f290c243be236ba80b776d440ec953c0823888e2e0dbc560215e4bf3fdc67f82ddd3d8715a9916c3015a1169a1e0425bfa6df13576eab2f4cc90932756f69144e16920cb9cab36adfd18908ca0f648fa4c2f831b10981dc045a39179e22588ae0f6c86e0979ec5a394f3cfc6b2a9376b0fd4b80540000000b49f4b9efa64cd389a89484cdae70cba3e7e2feb5e965158eb63051d40a706ce2944469df68ab6ae8ee4e1aa6834a9e28c95ecc9d175ed7d9daa50be0e17568d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a58ace66fb2ae94baa2183525e2f0ec50000000002000000000010660000000100002000000073b21438c53082cf939cffe382c9a3652aa507f1e091c98c607025365efef37e000000000e80000000020000200000004f764c54c86f6d72aaf908420f1adf17623d0f0414427dd01f2889d7265c87ff20000000a107e614791f962d5dfcbaf4d6237d09bfbd01c302f8ac75e89b4fffbf57e47f40000000e3e3d10629f35552f3284cf01b6b63d9dec375aa0252bc84003a5b3ed58b2f8b5742d3fa6c05f41a6a7b79fe5e0f54299ba977b5dd42e7abbc1517b62a4c31e5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5BBEFE71-2B37-11EF-9891-EEF45767FDFF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60195d3044bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2028 iexplore.exe 2028 iexplore.exe 1548 IEXPLORE.EXE 1548 IEXPLORE.EXE 1548 IEXPLORE.EXE 1548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1548 2028 iexplore.exe 28 PID 2028 wrote to memory of 1548 2028 iexplore.exe 28 PID 2028 wrote to memory of 1548 2028 iexplore.exe 28 PID 2028 wrote to memory of 1548 2028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af6ade889a927447b5a402483f5f07c2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2d0f1dd60576aa480c4151aa13a5043
SHA1ea254b265d917b6c3d096ae304e8a808c0f54a2f
SHA2562bd30f0b44e3eb3a3f7f235d59339c34208ee5b66f70442bb45d9c9191300291
SHA512a741c260e0048d455a2c01fb4aa1aac4920f739280cba4051bade4ec5b6ac38e7c458ef8efb32ab9c3b31c073f4ce9ad9d2bfc097bc5dcb2f2773fa8abc0abfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50202705dbae5ffc6e17205a809350dca
SHA118fffa137c42743d28649dcb80e6afbf6d843aaf
SHA25692d20a5f4e819d9747fb703deeae747ce8c7fe5c5d4ace63cfec49e6d1ad164d
SHA512083b36c2db2997128fdf417e900e9b8e1cc32cb1984286d45e0ec17759a786c8bc5db8ff644ec66541d74bd48b735f0329ad388fddb66a17334ec187aa59c544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f9033b2523a084ca04f85ee981c9738
SHA1586c2411991b4b8c5fb55d278f16bab23bd2876e
SHA256e543cdad0a1e2872fec0fd3efd0b448f1e3e7ff25ab9cc19813eb20aca814813
SHA512a6660df9551250752df41ed1b17bf8d5fc4b25f8c6704990632ff607095de0856de41a734481c42682210a5836d736acacf9227e02518d4609aaa956badc50b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5524269281b7bf70be860e42b2a107817
SHA1b24dd77bc686f8f6fd41373f25c76d247596e7fd
SHA256ad8abbf00659931d3f63d916825a0c99a023fe51b2f0e55c3f69c5216d9d9c92
SHA512b8be8b6aef6b7b3fd3f668d48bca6da8909687317a1f27344b7b0cf149e99e2e8361887f8f6153306f167fe8447f615e6fa01e79ae4ff897042a00a04c811b92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b83aaf6038ed239f6fdd8161bbab2d16
SHA1beb2c1deae8aca86724d0e30da58c1da5c906d25
SHA25668c1deacb924387beda5a981192e4e4c2bc628afc784cd835c306a9449035a48
SHA51296d795b6fde51d1d2eb246b7827f1a1acc9ceed23ba2f42e1abb03b1f71ba86e8fa0a00d0a49fb0e056d57386cd87103b3a215299388f29bd3441bd9dd79bd70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2224cfda7f3596ee4a6532b68a64077
SHA1fe554f2994cfb1aca40d425f6bccbdd2d6bcf9f0
SHA2567afc9b74896c6772c774835083c2714d270bf52bcaa119e00a368cebfc124bc5
SHA512556ac2d614e73ac663692a20c0e15ad1c9b869e7ef559371b7770dc2875d9ecb3551144813223d4a66065c44681e41be29e824b5e2eec187241c120507018bc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b01a727b281b3d8b95b90b09ba17de7
SHA1be402e6ddff190edd1e9cff8f7f156c00f2671e4
SHA256953fecaf6e4889846779163ebd34ab1afb6de2d666c377e7e3b3fe675164445c
SHA512375fe4b916beaf30d30f0b8bb03a9867c2bf321b7e48b1335cbe97f0eb07f15674d0dfecb9e2249dfbe5eb85fbb4a47e713356ec7dbfa950c07ef0639f004f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0b1f6b670aed712962e384a15dc029b
SHA1a58ee492e49c6064b0c21376f7a65bea21b71be2
SHA2564c6381a244f91d7b8afc43be080022ba17c25945e3080e35d211ed99b08036b5
SHA512b75d1327116eb757f8c6b92891b990ea0d32054eed1274a85be4782be6429f0662e6cf27b2a9278ab325e6292aba2baccdc926fb8f38f3e64d60bf425eccc3c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a67ddd235e52b25fdc658d52f08b539e
SHA18f15cdb500a9d3a5b4fb5063fa8507358a45897a
SHA256344dd0f44e52de9a3aa5594ea93be4a665b434d2146d0bafeb3dd5d371281e29
SHA512d254225527bc48299042b18d4bc4c80fa78a034dd198334eca03f47ace64b0d2ebc5d7c6ff732d6d5d902cdbd7380931f904126d02412368cf36b63c0368ffb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bed53994b9c77b9a83782411c8d09f8
SHA113df2dfe7fe237e21d19d37f0ecec77bfe963e26
SHA2561b81d7f28b22964f2b3b6f891e3af93ad774d8e54eae4a2f1258106c06e511f8
SHA51299251e8cf8814196187dce43435896d3993b2d88e9cc01a21bea21b3699e7ced7c472d811d36709191a5d9983a714decfeee94c440fd6dd831bb91981168ec89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559a58dc9549a8a3f90ff784d63c06791
SHA19a5f5d979ecd608d2c00868f1c46f5b3f26b94b6
SHA25652dd86c6020f9607c504c4aec4b1cd2a4732b011bd282d1af73840f88d8e5f6a
SHA5121a11797c9b192617863820af8a593f841da15b4d77f67f0d03636b1050f226b6e1f45d6609f62aa05170c4c255d3625b3b6382d51ca0b13acd988adf872d4e07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5290f02b244270032c955a903b8d50d08
SHA1fd1c2bbd8f4228297759e47191b38dbe5dd76495
SHA256cfc73e9afcd6e0d0d31c78a14000e54b16dc42efcaee832a9f90fd576b3c4411
SHA512206f9ba6e92c2bfb62c32d76e4cb1615cbf1c97b7017b01743c9c64bde32244d367ca23a26069a656145107e571df0731990fee364579815db8e46b2c09e8a76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c13b32c8c1c1b249212df4bb8a1bb1a8
SHA1560c8c2971f8a5362941364853977c7ba929ed31
SHA25646f5df976db86387b7727bc64f08ee44a0490427fb2b30261799d0327ce0b67b
SHA512e40fd0541b70b210e7a276da18be732622a54b7e2ed50e91bd7575dc31ba6312220f122371e7a384d6e1b1120ef300dcd73b1840ba4d1d6789f39aefb823e2e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5629fd98c28b73ff2e175edd597db4229
SHA149fa87e9ef23461650db6c859e7cedcb8a51694a
SHA256ce1b47b398bc69e1f5e0180dac8de448aa4ed3730e7440feed46dd19a4ee637d
SHA512fa8ed9ab59bfd547063a82769464c434fd5524aede5fe6bc189a563933c89d440cc519f5d74f893fea0b525f1fadf66d2899fbfb475e80c753e4b7b4a400da60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5344866046cd3638dcae57deb0cd7c583
SHA1172b865e79da9dc413f00feb4f58562daafe093f
SHA256c231f43cb3d3dcffa4c2459e29eb8f6504557684903629bdaf8821014b84d1ff
SHA5121978ecb95fd6592bef6227676f0aa5aaa3b357814250a3c202d7f03ef590f5799f67e2b4b513191568c454e920de006841b1e3badc6336f3bd119cafc6f634c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de50303d37f235b842c275fec0442fe4
SHA101fef443ea1b672fd8346631a9d50b6b4b9ed8b3
SHA256febf3b340a1143e6c8f6f869acf8a1ade2a929af140edb8d26836adca72e9d22
SHA512974fae64e42cb5931c1dc97bc7939cc0d120b8809ea1c5279f6fb20b860db3b8c7ce051c052564f2e79b4d78c9c9420af35a733e5741a2b3035ac4c33c44d7b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d8cbae64d5b0f28a400463b491949eb
SHA1d57c60d33442122689f50f2ee4f94970e0c389e9
SHA256c5ab77a942e6b7833b2f79a6bb9db5b1726f521a50deb56ffb96fc88560f5420
SHA51216006198820aac71848cc59e95f203e6e3980b6839328b770fe883aa33d4e93a9cfa12b08410cb33990657816a06449c583db0863d5a2c894142873f522ab1cd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b